search

kraj / meta-clang

Clang C/C++ cross compiler and runtime for OpenEmbedded/Yocto Project
MIT License
151 stars 192 forks source link

bpftrace: fix CVE-2024-2313.patches via upload #954

Closed meenaligupta159 closed 2 weeks ago

meenaligupta159 commented 3 weeks ago

If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

petermarko commented 1 week ago

@kraj @meenaligupta159 this patch file is in root of the repository and obviously also not referenced in any recipe, so I'm not sure why it was merged

kraj commented 1 week ago

@kraj @meenaligupta159 this patch file is in root of the repository and obviously also not referenced in any recipe, so I'm not sure why it was merged

Yeah it is wrongly done I will have to revert it unless a PR to correct it is in place

would you mind correcting it ?

petermarko commented 1 week ago

I'll rather not handle patch which I don't know, so the PR author has to step in

kraj commented 1 week ago

I'll rather not handle patch which I don't know, so the PR author has to step in fair enough. Thanks for reporting though, its huge help. I have reverted it via - https://github.com/kraj/meta-clang/pull/959